Collabora CODE flaw exploited to backdoor Nextcloud servers
Attackers have been abusing a critical command execution vulnerability in a Collabora app for Nextcloud for about a month. The flaw only received a CVE identifier this week.
The bug is tracked as CVE-2026-110447. It affects the Collabora Online - Built-in CODE Server app, known internally as richdocumentscode. Nextcloud administrators use this optional app to run a bundled Collabora document server directly inside their Nextcloud instance, so they don't have to deploy a separate one.
According to reports from several administrators, exploitation started in mid-September. That was roughly four weeks before the security bulletin, the GitHub advisory and the CVE entry were published.